Deceptive Signal-Assisted Private Split Learning

• The paper demonstrates a defense mechanism that perturbs intermediate activations and gradients to prevent label and feature leakage in split learning.
• It details multiple strategies—including gradient, embedding, and supervisory deceptions—to deliberately corrupt the attacker’s inference metrics while maintaining task performance.
• Empirical findings show that these methods achieve strong privacy protection with minimal utility loss, though adaptive attack strategies and deployment challenges remain.

Searching arXiv for the cited split-learning privacy and defense papers to ground the article in current arXiv records. Deceptive Signal-Assisted Private Split Learning denotes a family of split-learning defenses that intentionally alter the observable signal at or around the cut layer so that honest-but-curious adversaries cannot reliably exploit intermediate activations, gradients, supervisory targets, or over-the-air transmissions to infer labels, reconstruct private features, or invert inputs. The topic emerges from a sequence of attack papers showing that plaintext split learning leaks through both smashed data and backpropagated gradients, and from defense papers that respond by injecting targeted perturbations, reshaping embedding geometry, training on secret higher-dimensional fake labels, redesigning modality-specific communication, or coordinating deceptive wireless transmissions across multi-hop training paths (Liu et al., 2022, Qiu et al., 2023, Erdogan et al., 2021, Yang et al., 2022, Zheng et al., 2022, Jiang et al., 2024, Yao, 2024, Wei et al., 9 Jul 2025).

1. Split-learning interface and privacy surface

In split learning, a model is partitioned at a cut layer and jointly optimized by two or more parties. In a common formulation, the client-side bottom model $f_\theta$ computes smashed data $s=f_\theta(x)$ and sends it to the server; the server-side top model $h_\phi$ computes logits $z=h_\phi(s)$, probabilities $p=\mathrm{softmax}(z)$, and the loss $L(x,y)=-\sum_i y_i \log p_i$, then returns the cut-layer gradient $g=\partial L/\partial s$ to the client (Liu et al., 2022). In vertical split learning for tabular data, the partition may be arranged differently, but the same structural fact remains: the exchanged messages are cut-layer activations and cut-layer gradients, and these messages are the privacy-critical channel (Qiu et al., 2023).

This privacy surface is broader than raw-data concealment. The client may never reveal $x$, and the label owner may never reveal $y$, yet the exchanged transcript can remain strongly informative. The cut-layer representation is optimized specifically to support downstream prediction, so it can retain class-conditional structure; the backward gradient depends on the private label through the chain rule; and in wireless or generative deployments, even the transport or conditioning path can become a leakage vector (Liu et al., 2022, Qiu et al., 2023, Yao, 2024, Wei et al., 9 Jul 2025).

A recurring misconception is that hiding raw features or labels is sufficient. Attack work in split learning rejects that premise: privacy risk concentrates in the intermediate signal rather than only in the original data modalities (Erdogan et al., 2021, Qiu et al., 2023).

2. Why labels and features leak from intermediate signals

The central analytical mechanism for label leakage is the softmax-cross-entropy gradient. With one-hot label $y$, the gradient at the logits is

$s=f_\theta(x)$0

When a linear layer $s=f_\theta(x)$1 and bias $s=f_\theta(x)$2 sit above the cut, $s=f_\theta(x)$3, so the cut-layer gradient becomes

$s=f_\theta(x)$4

Equivalently, in a layerwise view with last hidden activation $s=f_\theta(x)$5 and final weight matrix $s=f_\theta(x)$6, the gradient is $s=f_\theta(x)$7 (Liu et al., 2022). Because $s=f_\theta(x)$8 is label-structured, gradients from samples of the same class share similar directions even when magnitudes vary.

Forward embeddings leak for a complementary reason. As training proceeds, the client model learns discriminative features whose Euclidean geometry becomes class-conditional, especially when the cut approaches the output. Same-class points cluster, inter-class separation increases, and nearest-prototype or clustering procedures on smashed data become effective (Liu et al., 2022, Zheng et al., 2022).

These mechanisms motivate several attack families. Similarity-based attacks classify gradients by cosine similarity to class templates and smashed data by Euclidean proximity to class prototypes; on normalized vectors, cosine and Euclidean similarity coincide through $s=f_\theta(x)$9, which yields a unified attack geometry (Liu et al., 2022). EXACT instead performs exhaustive gradient matching in tabular split learning: it enumerates categorical client feature-label configurations, simulates the corresponding cut-layer gradients, and returns the configuration with minimal $h_\phi$0 distance to the observed gradient. On Adult, Bank Marketing, and Taobao, EXACT reconstructs labels perfectly with $h_\phi$1 in both SL and FSL, and reconstructs many private categorical features with near-perfect $h_\phi$2 on Adult and Bank (Qiu et al., 2023). UnSplit addresses a different axis: data-oblivious model inversion and model stealing from smashed activations, plus perfect label inference when only the output layer is hidden at the client and the client depth is one (Erdogan et al., 2021).

Empirically, the attack literature establishes that leakage is not marginal. Similarity-based label attacks can achieve close to $h_\phi$3 accuracy, and gradient-based attacks reach $h_\phi$4 accuracy at the last layer even for ImageNet-1000 in the reported setup (Liu et al., 2022). This attack success is the direct motivation for deceptive signal assistance.

3. Deceptive-signal principle

Deceptive signal assistance does not merely add arbitrary noise. Its characteristic objective is to corrupt the exact statistic an attacker uses while leaving the benign training objective solvable. In the similarity-attack setting, the defense goal is to reduce $h_\phi$5 for class templates and to make nearest-prototype distances $h_\phi$6 ambiguous. The synthesized defense objective reported in the label-inference work is

$h_\phi$7

with proposed regularizers that directly penalize peak cosine similarity of gradients or preserve task performance while collapsing exploitable geometry in feature space (Liu et al., 2022).

In gradient-matching attacks such as EXACT, the same principle appears in a different form. The attack depends on a nearly one-to-one relation between a private configuration and the observed cut-layer gradient. Injecting small, clipped noise into $h_\phi$8 functions as a deceptive signal because it makes many candidate configurations approximately equidistant under the attack’s $h_\phi$9 metric; the paper’s majority-vote sensitivity study shows that near matches are unreliable, so even small perturbations can sharply degrade reconstruction (Qiu et al., 2023).

A formally developed instance of this idea is Transcript Private Split Learning, or \textsf{TPSL}. There, the label owner perturbs gradients along the most label-informative direction $z=h_\phi(s)$0 rather than isotropically. The binary GradPerturb mechanism releases

$z=h_\phi(s)$1

with $z=h_\phi(s)$2 and $z=h_\phi(s)$3, or with a discrete randomized-response analogue. By coupling the perturbation to the last hidden layer and reusing the same perturbed signal for both the backward message and the label party’s own update, the protocol attains $z=h_\phi(s)$4-transcript DP; perturbing the two objects separately yields $z=h_\phi(s)$5-transcript DP (Yang et al., 2022).

Across these formulations, the common design rule is stable: the signal should be deceptive in the attacker’s metric, not merely noisy in the Euclidean sense.

4. Major defense families

Family	Signal modified	Representative mechanism
Gradient deception	Backward cut-layer gradients	DP-SGD at the cut layer; directional GradPerturb; orthogonality-based $z=h_\phi(s)$6
Embedding deception	Forward embeddings or smashed data	Potential energy loss; feature-space perturbations; randomized masking or mixup
Supervisory deception	Labels or targets used during training	Secure Dimension Transformation with fake $z=h_\phi(s)$7-class labels and soft targets
Modality/system redesign	Communication path and conditioning pathway	No-gradient-return split for ControlNet; prompt hiding; privacy-preserving activation
Physical-layer deception	Over-the-air model transmissions	Decoy devices, deceptive transmit powers, multi-hop split assignment

One line of work reshapes the forward representation itself. “Potential energy loss” adds a same-class repulsion term to the split-learning objective. In Euclidean form,

$z=h_\phi(s)$8

and, after layer normalization to $z=h_\phi(s)$9, an angular form replaces Euclidean distance by $p=\mathrm{softmax}(z)$0. The full objective is $p=\mathrm{softmax}(z)$1. Its stated purpose is to push same-class embeddings toward the decision boundary and toward near-orthogonal arrangements, thereby reducing clustering structure and making few-shot fine-tuning of a leaked top model unstable (Zheng et al., 2022).

A second family modifies supervision rather than only the representation. Secure Dimension Transformation, or SecDT, expands the original $p=\mathrm{softmax}(z)$2-class label space to a secret $p=\mathrm{softmax}(z)$3-class space by shuffling the $p=\mathrm{softmax}(z)$4-dimensional one-hot basis, partitioning it into disjoint pools $p=\mathrm{softmax}(z)$5, and mapping each true label $p=\mathrm{softmax}(z)$6 to a pool-specific fake one-hot target $p=\mathrm{softmax}(z)$7. Decoding aggregates probability mass over the corresponding pool using $p=\mathrm{softmax}(z)$8 and predicts $p=\mathrm{softmax}(z)$9. SecDT is combined with batch-wise gradient normalization,

$L(x,y)=-\sum_i y_i \log p_i$0

and with softmax-normalized Gaussian noise on the targets,

$L(x,y)=-\sum_i y_i \log p_i$1

The defense is designed to break direction, norm, spectral, and model-completion attacks while keeping the original task decodable (Jiang et al., 2024).

A third family is modality-specific. In split ControlNet and Stable Diffusion training, the proposed redesign freezes all client-side modules, eliminates gradient return entirely, and has the server return only the predicted noise $L(x,y)=-\sum_i y_i \log p_i$2. Privacy is reinforced by a timestep sampling policy derived from diffusion forward noise,

$L(x,y)=-\sum_i y_i \log p_i$3

with an $L(x,y)=-\sum_i y_i \log p_i$4-LDP characterization

$L(x,y)=-\sum_i y_i \log p_i$5

by a privacy-preserving activation

$L(x,y)=-\sum_i y_i \log p_i$6

where $L(x,y)=-\sum_i y_i \log p_i$7 and $L(x,y)=-\sum_i y_i \log p_i$8 is a fixed secret client-side offset, and by prompt-hiding that keeps text prompts on-device while feeding zero text features to frozen server-side SD blocks (Yao, 2024).

A fourth family operates at the communication layer. In deceptive signal-assisted private multi-hop split learning, a subset of devices performs collaborative training while another subset transmits deceptive RF signals so that eavesdroppers capture the wrong hop. The design jointly optimizes the training-device subset, deceptive-device subsets, split points, sub-model assignments, and transmit powers under latency and energy constraints. The proposed solver is a soft actor-critic framework augmented with an Intrinsic Curiosity Module and cross-attention, denoted ICM-CA (Wei et al., 9 Jul 2025).

5. Empirical findings and utility–privacy trade-offs

The empirical record is mixed in mechanism but consistent in one respect: split learning without active protection leaks severely. Similarity-based attacks reach near-$L(x,y)=-\sum_i y_i \log p_i$9 label inference across datasets and cut positions close to the output, and the inference-phase smashed-data attack remains far above random guessing even on ImageNet-1000 (Liu et al., 2022). EXACT reconstructs labels perfectly and reconstructs many categorical private features with high $g=\partial L/\partial s$0 on tabular workloads; UnSplit reconstructs inputs and steals functionally similar client models without auxiliary data (Qiu et al., 2023, Erdogan et al., 2021).

Defense efficacy depends strongly on the attack model and modality. In tabular DeepFM experiments, a small cut-layer DP noise multiplier $g=\partial L/\partial s$1 sharply reduced EXACT reconstructions while decreasing test AUC only slightly: Adult remained at about $g=\partial L/\partial s$2, Bank dropped from $g=\partial L/\partial s$3 to about $g=\partial L/\partial s$4, and Taobao from $g=\partial L/\partial s$5 to about $g=\partial L/\partial s$6 (Qiu et al., 2023). By contrast, the similarity-based label-inference study reports that DP-SGD, label differential privacy, gradient compression, and Marvell did not prevent similarity-based attacks unless the perturbation was so strong that utility collapsed; the paper attributes this to the persistence of label-dependent directionality in $g=\partial L/\partial s$7 and class-conditional geometry in $g=\partial L/\partial s$8 (Liu et al., 2022). This suggests that “DP protects split learning” is not a universal statement but a result conditioned on the attack metric, model family, and signal geometry under study.

Geometry-shaping defenses report strong protection against inference-phase attacks on embeddings. Potential energy loss significantly lowers both fine-tuning attacks and clustering attacks, and the reported result is “perfect protection” for clustering in all evaluated tasks, with smoother utility–privacy trade-off curves and smaller variance than DcorLoss and LabelDP (Zheng et al., 2022). Supervisory deception through SecDT reports that, on Avazu, the average attack AUC of the four evaluated attacks is reduced by approximately $g=\partial L/\partial s$9 relative to no defense, with communication unchanged and end-to-end time cost increasing by approximately $x$0 (Jiang et al., 2024). In the generative setting, the no-gradient-return redesign reduces client time from $x$1 to $x$2, reduces transmission from $x$3 to $x$4, and on the Scribble condition reports centralized/splitting/defended FID values of $x$5, $x$6, and $x$7, respectively, while also lowering inverse-network condition reconstruction quality in defended settings (Yao, 2024). In multi-hop wireless split learning, ICM-CA improves convergence rate by up to $x$8 and reduces leaked information by up to $x$9 compared with traditional SAC (Wei et al., 9 Jul 2025).

A second recurring misconception is that deceptive assistance must mean crude additive noise. The literature instead includes geometry shaping, secret relabeling, pathway redesign, prompt withholding, and physical-layer decoys. The commonality is not the perturbation form but the deliberate corruption of the attacker’s decision function.

6. Limitations, boundary conditions, and open directions

Current defenses remain partial. Potential energy loss explicitly does not address training-phase label leakage via gradients and is recommended to be combined with cryptographic secure computation, DP gradient perturbation, or training on non-sensitive data when gradient attacks are relevant (Zheng et al., 2022). SecDT depends on secrecy of the transformation parameters $y$0; if the secret mapping leaks, directional protection can be partially restored, although softmax-normalized Gaussian noise still contributes protection (Jiang et al., 2024). \textsf{TPSL} focuses on label privacy in the backward pass, while forward-activation protection remains an open problem in that framework (Yang et al., 2022).

Attack adaptation also remains central. The similarity-based defense synthesis explicitly warns that adaptive attackers may re-estimate templates under deception, motivating refreshed discriminative subspaces, randomized transforms, and varying projections over time (Liu et al., 2022). EXACT is evaluated on categorical or discretized private features, and the tabular study notes that continuous high-dimensional features, very large category spaces, and non-IID federated settings remain open directions (Qiu et al., 2023). The ControlNet privacy design assumes an honest-but-curious server, secret client weights, and no malicious clients; query-based attacks are mitigated by protocol structure rather than eliminated in a universal adversarial model (Yao, 2024). The multi-hop wireless framework assumes max-SNR capture by eavesdroppers and notes that adaptive signal-combination strategies would require stronger robustness analysis (Wei et al., 9 Jul 2025).

Taken together, the literature indicates that deceptive signal-assisted private split learning is less a single algorithm than a design philosophy for hostile intermediate representations. Its central thesis is that privacy in split learning is governed by the geometry, semantics, and observability of the cut-layer signal and its transport path. Consequently, robust systems increasingly combine targeted cut-layer perturbation, representation shaping, secret supervisory transformations, protocol redesign, and communication-aware deception rather than relying on plaintext model partitioning alone (Liu et al., 2022, Qiu et al., 2023, Zheng et al., 2022, Jiang et al., 2024, Yao, 2024, Wei et al., 9 Jul 2025, Yang et al., 2022).